extortion.wiki THE RANSOMWARE DOCUMENTARY ARCHIVE
Menu

242 negotiations · 332 notes · snapshots Jul 06, 2026 / Jun 26, 2026

Dragonforce — C7CD31EAAF9DE9AC

Date not recorded

From extortion.wiki, the ransomware negotiation research archive

A validated static rendering of 71 messages in source-array order. Transcript text is preserved without editorial additions.

Actor
Dragonforce
Record date
Date not recorded
Messages
71
Participants
Attacker, Victim

Preserved messages

Actor / other Victim

Select a message number for a stable citation link. Text remains selectable; hard-wrapped source lines are joined for reading, intentional blank-line paragraph breaks remain, and written URLs remain inert.

  1. Message 001 From Victim Victim Date

    hello? there was a readme.txt file with instructions to come to this site. can you please explain what is going on? the files have.dragonforce_encrypted on the end of them and are not opening.

  2. Message 002 From Attacker Actor / other Date

    Hi, wait.

  3. Message 003 From Attacker Actor / other Date

    Attachment sent: tree_mastery.zip (3.38 MB)

  4. Message 004 From Attacker Actor / other Date

    Besides the fact that the files on your network are encrypted, you have also lost some of them. They are with us. Here is a list of them.

  5. Message 005 From Victim Victim Date

    what is this? a list of the files? what do you mean by 'lost'? were they deleted?

  6. Message 006 From Attacker Actor / other Date

    We have these files. As well as a program to restore information on your computers.

  7. Message 007 From Victim Victim Date

    okay. so in addition to scrambling the files, you also stole files? are the files from this list (the files you stole) still on my computers?

  8. Message 008 From Attacker Actor / other Date

    Yes, that's right

  9. Message 009 From Victim Victim Date

    all the filenames are scrambled so i don't know what files are what. for proof you can unscramble them, you say you need a certain file type, but i have no idea what files are what on my side.

  10. Message 010 From Victim Victim Date

    what do you want from me??

  11. Message 011 From Attacker Actor / other Date

    The architecture of the folders with your files is not broken. You can select a small file from a folder whose contents you know, and we will do a test decryption. Examples of such files are described in the rules, they cannot be critical data.

  12. Message 012 From Victim Victim Date

    i will try to guess and find the right files to decode. without the filenames, i simply won't know for sure. can you explain why you attacked me and what you want?

  13. Message 013 From Attacker Actor / other Date

    You've probably already used Google and know who we are and what we want. We will restore the data from you and delete the data from us after you pay. Otherwise, the data we have will be published. It is often not immediately believed that without payment we will actually publish the data. So check out our blog and make sure we do it.

  14. Message 014 From Victim Victim Date

    i think i understand all of that. but what do you want from me?

  15. Message 015 From Attacker Actor / other Date

    Money

  16. Message 016 From Victim Victim Date

    here are 3 files from the list you sent me.

  17. Message 017 From Victim Victim Date

    1) [Redacted]20190304.xlsx

  18. Message 018 From Victim Victim Date

    2) [Redacted].msg

  19. Message 019 From Victim Victim Date

    3) [Redacted]23-24.pptx

  20. Message 020 From Attacker Actor / other Date

    Attachment sent: [Redacted]20190304.xlsx

  21. Message 021 From Attacker Actor / other Date

    Attachment sent: [Redacted].xlsx (42 KB)

  22. Message 022 From Attacker Actor / other Date

    Attachment sent: [Redacted].msg (87 KB)

  23. Message 023 From Attacker Actor / other Date

    Attachment sent: [Redacted]23-24.pptx (3.96 MB)

  24. Message 024 From Victim Victim Date

    does the list of files you sent show all the files you took?

  25. Message 025 From Attacker Actor / other Date

    Yes

  26. Message 026 From Victim Victim Date

    i have 3 small scrambled files from a windows computer. i have no idea what files they are, but are from a folder that shouldn't have anything important. how do i give these to you to prove to me that you can fix them?

  27. Message 027 From Attacker Actor / other Date

    You should have uploaded the decryption verification file in the previous step in this dialog. You had instructions on how to do it.

  28. Message 028 From Victim Victim Date

    how do i get back to that step?

  29. Message 029 From Attacker Actor / other Date

    We have now moved you to this step again. Try refreshing the page.

  30. Message 030 From Victim Victim Date

    okay. i put 1 of the files through

  31. Message 031 From Attacker Actor / other Date

    You have made sure that we have your files and we have a file recovery tool on your network.

  32. Message 032 From Attacker Actor / other Date

    Have you already assessed the situation and are ready to discuss payment, or would you like more time? As per our rules, I will need to make an announcement regarding the publication of your data on our blog tomorrow if negotiations continue to drag on.

  33. Message 033 From Victim Victim Date

    What negotiatons? I asked what you want and all you say is money. I'm not sure what I'm missing or should do at this point. I am waiting for you to tell me what you want.

  34. Message 034 From Attacker Actor / other Date

    Attachment sent: 2023 Form 990 for Mastery Schools.pdf (583 KB)

  35. Message 035 From Attacker Actor / other Date

    Do you know this document?

  36. Message 036 From Attacker Actor / other Date

    Usually, for a company of your size, the amount is $2,000,000. But since you are filing tax reports on Form 990, we are ready to reduce it to $950,000. This way you can hide it in the reports and keep the whole incident a secret.

  37. Message 037 From Victim Victim Date

    I know you have my files. You already proved this. What do you want?

  38. Message 038 From Attacker Actor / other Date

    $950 000

  39. Message 039 From Victim Victim Date

    We are talking through everything and trying to process next steps. Can you confirm for us what we would get if we were to pay you?

  40. Message 040 From Attacker Actor / other Date

    Read the F.A.Q., there are answers. More specifically, we will not publish your files (we will delete them) you will also receive a decryption program.

  41. Message 041 From Victim Victim Date

    We are meeting next week with finance to see how much we can pay. I'll be back after the weekend. Thanks

  42. Message 042 From Attacker Actor / other Date

    Okay, i get you. I will turn off the timer until friday next week, to facilitate negotiations. Can you name a day when you will have an answer?

  43. Message 043 From Victim Victim Date

    We are meeting about this now and we simply don't understand why you are asking for so much. Your price is just so high that we honestly don't see anything we can do on our end. We know you have all of our files and know exactly how much money we have, but why ask for more money than you know we have? Paying you seems impossible at such a high amount.

  44. Message 044 From Attacker Actor / other Date

    Earlier, I sent you the file with your tax records. These are the official documents that you submitted to the tax authorities. They show the amounts of your income and expenses. Is the information you submitted to the tax service unreliable?

  45. Message 045 From Victim Victim Date

    We are a public school. Our "income" isn't normal income like a company. We don't generate revenue and don't have income. We operate on a strict and tight budget.

  46. Message 046 From Attacker Actor / other Date

    We have reviewed your documentation, not just the file you sent us above. The amount you are being offered is significantly lower than what a commercial organization would receive.

  47. Message 047 From Victim Victim Date

    For that, we are appreciative. I don't mean to be disrespectful or unappreciative, but we just don't have the budget for a massive expense like this. You have all of our documents and can see this. Our athletic department doesn't even have the funds to travel to away sporting events so they are trying to raise funds with bake sales and car washes.

  48. Message 048 From Victim Victim Date

    Listen, I don't want to waste your time. Can you let me know the lowest amount you would be willing to accept so we can see if a payment is even possible?

  49. Message 049 From Attacker Actor / other Date

    I've given you the amount. Now I expect the amount from you. We will discuss this and eventually come to some figure. It usually happens like this. And if we are not talking about deliberately small amounts, then negotiations can go very quickly, to our mutual satisfaction.

  50. Message 050 From Victim Victim Date

    Okay. We will review the budget and see how much funding we can allocate to this, but please be aware that it won't be much. We also would like to arrive at a mutual agreement. I'll be back

  51. Message 051 From Attacker Actor / other Date

    Ok

  52. Message 052 From Victim Victim Date

    We think we can pay something around $80,000

  53. Message 053 From Attacker Actor / other Date

    It seems to me that you misspelled the amount there. Forgot one digit in the number of $800,000

  54. Message 054 From Victim Victim Date

    No, not a typo. We can't offer what we don't have. Anything you can do to make this work?

  55. Message 055 From Attacker Actor / other Date

    There is one option. You raise the amount to 2 BTC exactly. Now it's about $127,000. And you name the date by which you will pay, if we agree today. And I will try to explain to the management that despite the grants and sponsors, you don't have any more money and we can make such a deal. Perhaps the management will agree.

  56. Message 056 From Victim Victim Date

    We can't commit to anything before we take a closer look at our budget. This is a really large amount for us so we can't act on it instantly. Can we get back to you by the end of the week?

  57. Message 057 From Attacker Actor / other Date

    The longer the negotiations take, the more difficult it will be for me to convince the management of this amount. But as I promised you, the timer is stopped until the end of the week.

  58. Message 058 From Victim Victim Date

    Thanks

  59. Message 059 From Victim Victim Date

    Good morning. We've been meeting and working on this for a few days now and the most we are able to afford to pay is still $80,000. We are a public school and simply don't have the budget for something like this. That said, we are trying to get an appointment to meet with the State Education Board to see about obtaining an emergency grant. Due to the Jewish holiday, we won't be able to get an appointment until after the weekend. I know you've been very patient with us so far, so all I ask right now is that you continue to remain patient so we can meet after the weekend to try to get the funds to pay you. Is this okay?

  60. Message 060 From Attacker Actor / other Date

    On monday, will you tell me the result and the date when you will make the payment?

  61. Message 061 From Victim Victim Date

    On Monday, I hope to know when we'll be able to meet with the State BOE. I'll let you know when we'll be able to meet with them. I know for any emergency funding requests, there's a vote that needs to take place and it could take a few days to be approved after the initial meeting.

  62. Message 062 From Victim Victim Date

    My guess is we'll meet on Tuesday or Wednesday and hopefully by Friday we should get approved, or at least have a good idea of when we'll be approved.

  63. Message 063 From Attacker Actor / other Date

    Ok. I will be waiting for information from you.

  64. Message 064 From Victim Victim Date

    Thank you. I know the timing isn't ideal for either of us, but I appreciate your patience.

  65. Message 065 From Victim Victim Date

    Good morning, I have good news. We have an appointment to meet with the State Board of Education on Wednesday. They are aware of the situation and that we will request emergency funding. After the meeting on Wednesday, I will be back to let you know how it went.

  66. Message 066 From Attacker Actor / other Date

    Ok, we will be waiting for information from you.

  67. Message 067 From Victim Victim Date

    Good news! We got an appointment to meet with the State BOE to explain the situation and to request emergency funding. We will meet with them on Friday afternoon. They said that they'll have to vote on the measure of the emergency funding request during their next closed-door session, which will happen on Thursday, October 17th in the morning. Once the voting is done, they will let us know right away and then I'll be back here to let you know.

  68. Message 068 From Victim Victim Date

    I know that's not until next week, but we'll just have to be patient because they are the only ones who can help. In the meantime, can you please explain in detail how the payment process works?

  69. Message 069 From Attacker Actor / other Date

    You will need to pay BTC to the wallet address given to you. To exchange USD for BTC, you need to use any intermediary that suits you. We will only accept BTC.

  70. Message 070 From Victim Victim Date

    Okay. We will start looking into that now. I'll be back after the vote next Thursday, the 17th. Once you have a bitcoin address for us to use, please provide it.

  71. Message 071 From Attacker Actor / other Date

    I can provide it right now. It has been added to the section for payment on your part. And the amount indicated is 2 BTC. Right now it's $123,660